Critical DifyTap Vulnerabilities Expose AI Data Across 1M+ Apps

• •Four critical vulnerabilities in Dify expose sensitive AI data across tenants.
• •CVE-2026-41947 and CVE-2026-41948 allow unauthorized access to private conversations.
• •Patches for the vulnerabilities have been released, but significant risks remain.

Zafran Labs identified four vulnerabilities in Dify, an open-source AI platform used by over one million applications, including critical flaws allowing cross-tenant data leakage. Two vulnerabilities, CVE-2026-41947 and CVE-2026-41948, are rated critical, enabling attackers to access private conversations and documents without authentication. The flaws stem from inadequate tenant isolation and API trust boundaries, allowing one customer's data to be accessed by another. Additionally, CVE-2024-5846, a known use-after-free vulnerability in PDFium, remained unpatched for over 18 months. The vulnerabilities were disclosed responsibly, and patches have been released in version 1.14.2 of Dify. The findings highlight significant security gaps in AI systems, particularly in multi-tenant architectures. Zafran's ongoing Project DarkSide aims to expose such weaknesses in AI applications.